The regulations governing an employer’s right to implement monitoring of employees’ business email accounts have been in force since 2018. However, we continue to receive numerous inquiries regarding email monitoring. Below is a practical guide to facilitate the implementation of employee email monitoring within an organization or to verify whether the existing regulations comply with the law.
Email Monitoring – When Can It Be Introduced?
The legal basis for implementing monitoring of employees’ business email accounts is Article 223 of the Labor Code. Email monitoring is permitted solely for the purpose of:
- Ensuring an organizational structure that enables the full utilization of working time; and
- Ensuring the proper use of work tools provided to the employee.
It should be noted that monitoring the full utilization of working time may involve, among other things, verifying the amount of time spent on business correspondence and/or analyzing the quantitative workload performed by the employee.
Proper use of business tools primarily entails ensuring that employees do not use company-provided equipment for non-work-related purposes during working hours.
It is important to remember that the above conditions must be met cumulatively. The Labor Code does not provide for any other circumstances that would justify the introduction of email monitoring. The closed list of permissible monitoring justifications raises concerns, particularly regarding the inability to introduce monitoring strictly for the protection of trade secrets.
Where Should These Regulations Be Included?
Employers covered by a collective bargaining agreement must specify the purpose, scope, and methods of monitoring in that agreement. If an employer is not covered by a collective bargaining agreement but is required to establish work regulations, the purpose, scope, and methods of monitoring must be included in those regulations. If an employer is not required to establish work regulations, the relevant provisions must be set out in an official announcement.
Purpose, Scope, and Methods of Monitoring
When formulating the appropriate provisions on monitoring, it is necessary to clearly define its purpose, scope, and methods of application.
- The purpose of monitoring business email accounts is directly derived from Article 223 § 1 of the Labor Code.
- Employers must assess whether the tools used in their organization are necessary to achieve the objectives of email monitoring. In some cases, it may not be necessary to review the actual content of emails, and merely analyzing the recipients of messages sent by employees may suffice.
- Employers should specify exactly which data will be subject to control and how this control will be implemented, including the tools and methods used.
What Are Your Informational Obligations as an Employer?
Email monitoring must be transparent. This means that employers are legally required to inform employees about the implementation of email monitoring in a manner customary in the organization. Employees must be notified at least two weeks before the monitoring tools are introduced. This may be done, for example, by emailing employees with the new regulations or posting them on a company bulletin board.
Additionally, before allowing a new employee to begin work, the employer must inform them about the purpose, scope, and methods of monitoring.
Email Monitoring and the Confidentiality of Correspondence
Under Article 223 of the Labor Code, monitoring of business email accounts must not infringe on the confidentiality of correspondence or any other personal rights of employees. A breach of confidentiality may occur when there is a real risk of unauthorized persons gaining access to the content of emails. The list of potential violations is open-ended and includes:
- Accessing the content of messages without authorization
- Modifying messages
- Disclosing correspondence to third parties
In cases where an employee uses company-provided equipment and a business email address linked to the employer’s name to perform their job duties, they are effectively communicating on behalf of the employer, rather than as a private individual. The fact that the correspondence is conducted under the employee’s name is irrelevant. Consequently, it is difficult to consider the employer as an unauthorized person or as infringing upon the employee’s right to confidentiality.
To mitigate potential risks associated with violating the confidentiality of correspondence, we recommend introducing a prohibition on using business email accounts for personal purposes. Additionally, employers may implement mandatory labeling systems to distinguish employees’ private messages.
Other Forms of Monitoring
In addition to video surveillance and email monitoring, employers may implement other forms of monitoring, the most common being:
- Internet activity monitoring
- Company vehicle tracking
The provisions of the Labor Code concerning email monitoring apply accordingly to other types of monitoring.
Conclusion
To summarize, monitoring of business email accounts is permitted if it serves the purpose of ensuring the proper use of working time and company-provided tools. Employers must clearly define the purpose, scope, and method of monitoring and include these provisions in the appropriate internal regulations. Employees must be informed about the monitoring in advance. However, email monitoring must not infringe on the confidentiality of correspondence or other personal rights of employees.
